User Profile
Neil2020
Copper Contributor
Joined 6 years ago
User Widgets
Recent Discussions
Audit-Failed Events not reaching Workspace
I have a test VM in Azure and one running on my home PC, Both have the MMA agent are are sending Security Events to Sentinel's Log Analytics Workspace via ASC connector configuration, Audi-Success events written to the security log on both machines are being sent to the Workspace but not Audit-Failure, eg: failed logon attempts to either machine, When I query for that EventID 4625 no results, (no syntax errors) I have tested clearing the Security log on both machines which produces an event in the workspace and I have an alert, also creating a new user and then adding them into loacla administrator group has expected results, What am I missing regarding Aufit-Failed events to have them flow through/from ASC to the Workspace? Diagnostic settings for the VM in Azure are set as below, although I have "All Events" configured Sentinel side via the connector: Any guidance would be appreciated before I raise another support ticket, Thanks, Neil
